21–30 of 78 posts
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
http://blog.fleetsmith.com/authenticating-to-hashicorp-vault...
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
We use StackExchange's blackbox [1] to check in GPG encrypted secrets into our monorepo (contains both ansible deployment playbooks and the code itself). This way, we can introduce secrets and the code that uses it in a single commit! [1] https://github.com/StackExchange/blackbox
Earlier quoted context omitted.
We use StackExchange's blackbox [1] to check in GPG encrypted secrets into our monorepo (contains both ansible deployment playbooks and the code itself). This way, we can introduce secrets and the code that uses it in a single commit! [1] https://github.com/StackExchange/blackbox
+1 for blackbox. Very nicely done!
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
I worry a lot about how these megacorps will treat "collaborators" vs "non collaborators" in the coming years. Obviously you can't just outright buy everyone, but they seem to be increasingly abusive towards technologies and teams that aren't on board with their interests and ideology. Actually I'm more worried about how Facebook and Amazon treat non compliance, but Google sure seems to be getting shadier every day.…
And the Googlers arrive right on cue, hahahaha
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
I almost never heard anything negative about vault until I did a presentation on all the troubles I had with it. Here are the slides about the issues I had: https://docs.google.com/presentation/d/1ipP2eB9pW5j3WDvzCGz9... At the end of the day, Vault gives you secret keys to manage which makes automating the unsealing process not fun if you want full automation. Talking with Armon from Hashicorp they planned to work o…
- name: unseal 1
expect:
command: '/usr/bin/vault unseal'
responses:
'Key \(will be hidden\): ': "{{vault_seal_key_1}}"
echo: yes
when: vault_sealed_result.rc == 2 and vault_seal_key_1 is defined
tags:
unsealWhat do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
The worst part about vault is managing access in a secure way and granting access to the right parts imo. We leverage the pki backend (or rather, three dozen pki backends) to map nodes to their respective policies and that required quite a bit of tooling to make work. But now it does, it's secure, and if need comes, it should be easy to revoke secret access for a cluster.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
What do people here use to store and source-control secrets/almost-secrets and make them available to (pick n) terraform/ansible/salt/chef/...? I've heard a lot of good things of Hashicorp Vault ( https://www.vaultproject.io ) but been hesitant to go with it.
Can't recommend Vault enough. By far the easiest and most capable solution to work with. The only downside I can point out is that the multi-cluster/region HA requires expensive enterprise licensing, but that is something most user cases don't require.